Please report security-sensitive issues privately to the repository owner instead of opening a public issue. Do not include private trajectory data, credentials, or access tokens in reports.

Uploaded XYZ text is parsed by ASE and is never directly concatenated into JavaScript. Renderer payloads are normalized, JSON-serialized, and escaped before embedding.